Method for remote controlling of www-browser

ABSTRACT

A method for remote controlling a www-browser, whereby a user is operating with an HTTP-server at his/her disposal by using his/her own www-browser for browsing various sources accessible over a communication network for documents, such that one or more clients in communication with the server have their browsers updated to display each document chosen by the user with his/her browser to be displayed. When the document chosen includes a hypertext document, indicated particularly by a URL-address, instead of an actual server response containing the URL-address, the user&#39;s browser is supplied with output from a separate script in communication with the user&#39;s server and operating as a filter. The output is externally equivalent to the desired hypertext document identified by the URL-address given to the filter script as a parameter, such that following a hypertext link included therein results in a request for the filter script with an address contained in the hypertext link as its parameter.

The invention relates to a method for remote controlling a www-browser,whereby a user is operating with an HTTP-server at his/her disposal byusing his/her own www-browser for browsing various sources accessibleover the internet, intranet or a similar communications network fordocuments of his/her choice, such that one or more clients incommunication with the server have their browsers updated to displayeach document chosen by the user with his/her browser to be displayed.

International patent publication WO 01/05093 discloses a method, wherebythe user is capable of directing the www-browsers of selected listenersto display documents from various sources accessible by his/herwww-browser e.g. over the internet or intranet. The discussed methodcovers e.g. applications, in which the controller is in advance able toprepare lists of URL-addresses (Universal Resource Location) specifyingthe way and route of retrieving documents to be displayed.

However, the above-cited publication does not describe exactly how theadministrator chooses the URL-address intended to be displayed by aclient's browser. One convenient way of doing this would be to allow theuser to browse through www-pages in a normal fashion, such that theclient's browser would be updated to always show the same page as theuser's browser. However, due to the security architecture of browsers,this cannot be achieved in traditional methods by just using awww-browser and scripting languages in a normal manner. By means of theabove-cited method, a function as mentioned above is neverthelessfeasible with certain limitations, without installing extensions to theuser's or client's browser, not to mention the use of Java or other suchexternal programming language. The method is based only on the normaloperation of a www-browser and on the characteristic capability of anHTTP-server to create dynamic pages in such a way that hypertextdocuments, especially those to be displayed in the controller's browser,will be processed in a server at his/her disposal, such that thefollowing hypertext links present therein results in a request for theserver to modify a document designated by a particular hypertext linkand then to return it to the user's browser for browsing and displaying,and then further to supply clients' browsers with a command to retrievethe document either from its original source, if that is accessible bythe clients' browsers, or from a database (or a similar storage system)in the user's server, which is used for storing documents not accessibleby the clients' browsers.

Other methods enabling a user to reflect his/her www-browsing toclients, such as e.g. services marketed under titles “Netmeeting” or“WebEx”, are based on the fact that, by means of separate software, itis possible to demonstrate the process of any application program forthe participants of a presentation or a conference, such that they willbe able to either monitor the user's activities or to operate thefunctions of applications assigned to them in accordance with thediscussed methods. These methods require specific operating systems andsoftware in order to function, as well as often also special networkconfiguration, nor is the operation thereof possible solely by means ofa www-browser and an http-server.

It is an object of the present invention to provide a decisiveimprovement regarding the above problems and thereby to raisesubstantially the available prior art. In order to fulfil thisobjective, a method of the invention is principally characterized inthat, when the document chosen to be displayed comprises a hypertextdocument, such as an html-page or the like, indicated particularly by aURL-address, instead of an actual server response containing thediscussed URL-address, the user's browser is supplied with an outputfrom a separate script in communication with the user's server andoperating as a filter, said output being a response externally similarto the desired hypertext document identified by the URL-address given tothe filter script as a parameter, such that the following of a hypertextlink included therein results in a request for the filter script with anaddress contained in the discussed hypertext link as its parameter.

The present invention provides a method, whereby the use of e.g. theforegoing (WO 01/05093) method can be significantly facilitated and mademore reliable. The method enables the user in a presentation to employnormal browsing techniques (to follow hypertext links) in order tobrowse www-pages in such a way that the clients' browsers repeat theuser's browsing activities concretely in real time. The method differsconsiderably from other currently employed remote control methods forcomputers, especially in the sense that it can be totally implementedsolely by means of a basic www-browser mechanism and a server adheringto an HTTP-protocol. On the other hand, as pointed out above, otheravailable remote control methods require support provided by separatesoftwares or browser extensions (appletts, script language programs, orthe like) both for the user's system and usually also for the clients'systems. As a result, such methods are highly complicated in terms oftechnology and require special expertise in order to successfullyorganise presentations or conferences.

Regarding the use of a method of the present invention, the client willnot be granting the user any authority over his/her own system, that isnot normally granted to the maker of some unfamiliar www-page, anyway.This is by virtue of the fact that, from the client's point of view, themethod in technical terms is totally equivalent to his/her browsing theweb for information presented by the user. Another result of this isthat, if the client is capable of browsing through sets of www-pages,he/she shall also be a capable participant in a presentation performedby means of the method. In this respect as well, other methods currentlyavailable for a similar objective generally impose considerably moreextensive technical requirements (allowing some protocol, Java operatingauthorization, etc.) on the clients' interfaces.

A benefit provided by the method both for a user and for clients isevident e.g. in the following occasions:

-   -   The user wishes to present his/her clients with some information        not found in his/her previously prepared agendas. With the        method, the user is able to find the information quickly in some        set of www-pages and visualise it immediately for the clients.    -   The user wishes to present his/her clients with an extensive        amount of information, the choices made therefrom depending on        the interests and reactions of clients.    -   The user wishes to display some set of www-pages (e.g. a        databank, archives, technical documentation). With the method,        the user is able to browse through the set of pages in a normal        manner and to describe subjects and data processing procedures        by following hypertext links indicating connections.

Other preferred applications for a method of the invention are set forthin dependent claims directed thereto.

The invention will be described in detail in the following specificationwhile making reference to the accompanying drawings, in which

FIG. 1 shows one general operating principle for a method of theinvention, and

FIG. 2 shows by way of an example the method as applied in the contextof such pages whose accessibility or contents depend on parameters to besupplied, such as e.g. on the information of a questionnaire.

The invention relates to a method for remote controlling a www-browser,whereby a user is operating with an HTTP-server Os at his/her disposalby using his/her own www-browser Ob for browsing various sourcesaccessible over the internet, intranet or a similar communicationsnetwork for documents of his/her choice, such that one or more clientsin communication with the server Os have their browsers Kb updated todisplay each document chosen by the user with his/her browser Ob to bedisplayed. When the document chosen to be displayed comprises ahypertext document, such as an html-page or the like, indicatedparticularly by a URL-address x, instead of an actual server responsecontaining the discussed URL-address, the user's browser Ob is suppliedwith an output ss(x) from a separate script ss in communication with theuser's server Os and operating as a filter, said output being a responseexternally equivalent to the desired hypertext document identified bythe URL-address x given to the filter script ss as a parameter, suchthat the following of a hypertext link included therein results in arequest for the filter script ss with an address contained in thediscussed hypertext link as its parameter. Thus, e.g., in reference tothe general method operating principle shown in FIG. 1, an original linka is replaced in the filtered page with a link ss(a), as describedabove.

The filter script ss, functioning as described above, can be e.g. anormal CGI-type script on some conventional http-server, but there arealso other options for its implementation. For example, if there are twoweb identifiers (domain names) allocated for an http-server, the servercan be configured in such a way that, when it is referred to by one ofthe web identifiers, it will “imitate” some other server (functioninglike a filter script described hereinafter), which is identified bysupplying it with necessary information, for example by way of a cookieor some other parameter passing method. This is equivalent to thecondition that the URL-address parameter to be given to the filterscript is supplied directly as a URL, which appears to refer to a serveridentified by the other web identifier.

After the filter script ss has been supplied with a desired URL-addressx as a parameter, a hypertext document indicated by the discussedaddress is first retrieved for processing, whereafter the filter scriptss is used to replace hypertext links a appearing in the document withlinks ss(a) which define a request for the filter script ss with thediscussed hypertext link a given as an argument therefor, and/orrelative references, such as URL-addresses, present in picture elements,cascading stylesheets, and/or the like, are converted into absolutereferences.

The filter script ss (or a second script associated therewith) mustnaturally handle also the filtering of cascading stylesheets in such away that the URL-addresses (e.g. a URL-address for a background image)appearing therein are indeed absolute.

In a further preferred embodiment of the method, the filter script ss isused in the first place to process forms embedded in a desired hypertextdocument, such that the handler defined therein is replaced with ahandler ss(x, p) supplied with information p of the form, and secondlythe original information, such as the original handler, is embedded ashidden fields concealed in the filtered form.

In a particular reference to the preferred embodiment shown in FIG. 2,when the user chooses, e.g. by following a hypertext link, a given pageto be displayed from the URL-address x, which depends on the parametersp, including input data for a form; cookies, user identification data orother such information defining the contents or accessibility of adocument indicated by the above-discussed address x, this document shallbe retrieved by the filter script ss from a given server s1, in whichthe x(p)-designated document is located, by supplying the filter scriptss with p as a parameter thereof in connection with an http-request.This is followed by filtering this page for the user's browser Ob asshown in the embodiment of FIG. 1, as well as separately also forclients to provide a document *x(p) which is stored in a database Db orother such system for the clients' browsers Kb by having all itsrelative addresses converted to absolute ones and documents containingother elements processed in a corresponding manner, e.g. as described inthe following segments of this specification. At this point, the filterscript ss additionally issues to the clients' browsers Kb a commandb(Db(x(p))) to display the document *x(p) by retrieving it from theoperator's server Os from the database Db by means of a normalhttp-protocol. In the operator's server Os, the subsequently requiredURL-addresses will be mapped by a given script or other similarapplication to pages stored in a database.

Hence, the documents *x(p) to be visualised for clients must be filteredin such a way that various sub-components—such as sub-documents embeddedin a document by means of a frame-tag, cascading stylesheets, etc.—shallbe retrieved from a database, in which they are stored, as soon as theuser's browser, after receiving the filtered documents, commences toretrieve them by presenting requests to the screen script ss.

Moreover, the mode of operation shown in FIG. 2 enables naturally thefilter script ss to edit forms embedded in www-pages, such that theoriginal handler x defined therein is replaced with a new handler ss(x,p), which is then supplied with information p of the form. The originalinformation of the form, such as the original handler and e.g. thetransmission method for the form's information, can be embedded in thefiltered form as hidden fields causing no distraction to the user.Executed this way, the method can also be used as the user performswww-based database retrievals, searches using search engines, etc., themethod making it possible for clients to monitor said functions subjectto the user's approval. It is important that the client's/clients'browser Kb not be supplied with information given by the user to thediscussed form, as such information may contain passwords, useridentifications or other data naturally confidential and not to bedisclosed to others.

Consequently, the method of FIG. 2 also makes it possible for the userto browse through password-protected sets of pages, which are protectedwith identification protocols included in an http-protocol in such a waythat the clients are able to monitor this, yet are unable to learnpasswords, nor can themselves start browsing through possibly delicateor important material. This can be achieved in such a way that, whencoming across a password-protected set of pages, the filter script sstransmits to the user's browser a page, in which this identificationdata is requested and which, as soon as the data is supplied, sends saiddata to the filter script ss which is now capable of retrieving therequired page by supplying the server containing it with theidentification data delivered thereto. Passwords for various securitydomains can be recorded in a database in such a way that, aftersupplying a given security domain once with the data, the user need notgive it a second time.

The method of FIG. 2 can also be used whenever the user browses sets ofpages using cookies which generally contain e.g. login information orother such information, which is why the simplified operating patternsshown e.g. in FIG. 1 are not sufficient for the reason that, because theclients' browsers Kb supply the servers with cookies other than those ofthe user's browser, the pages seen by the user and the clients aredifferent from each other. In order to rectify this, the filter scriptss stores, e.g. in a database Db, the cookies it has received from theservers and also sends the same along with requests as parameters p tothe servers and stores the pages received in a filtered form for theclients, as described above, and instructs the clients' browsers toretrieve the pages stored in the database.

Cookies may be also be used in scripts embedded in a page. The scriptsare filtered e.g. in such a way that all references to various objectscontaining browser information will be replaced with references to anobject, which is created by a script embedded in the page by the filterscript ss. Such objects only include information that is allowable for ascript coming from a given server. Such information includes the verycookies which have arrived from this particular server.

Another preferred application of the method is to organise e.g. variousmeetings or interactive presentations in such a fashion that theclients' browsers Kb also operate, whenever necessary and in a limitedmanner, the same way as the user's browser Ob, and the user's browser Obfunctions the same way as the clients' browsers Kb in the sense that itis always updated to display the view of relevant operating browsers.

In a further preferred application of the method, combined with theabove-described implementation, it is possible for several persons toe.g. edit and update sets of www-pages in collaboration, such that thefiltered pages to be produced for the user's browser are by means ofJavaScript and/or other tools provided with a capability of changing thecontents of a page in such a way that the changes will be updated forviewing by clients and other users.

In yet another preferred application, the user's interface can be usedfor disabling the linkage of one or more clients' browser Kb to theuser's browser Ob, particularly to make sure that the view on eachclient's www-browser is in all cases only supplied with controlleddocumentation instead of e.g. www-pages which have become outdated orirrelevant regarding the contents thereof.

As a further preferred feature, the user's interface provides apossibility for the user to keep open a larger number of browsingwindows in the process of browsing documents and to swich from window towindow in such a way that the client is always provided with a view ofthe page which the user has in the active window at that time.

Thus, a foundation of the method is that the user's browsing activitiesare “rerouted” through an HTTP-server containing pages and scriptsrequired by him/her. By virtue of this, the user's browsing activitiescan also be readily conveyed to a client's browser, e.g. as described inthe above-cited method (WO 01/05093). It is also possible to employ thepresent invention in combination with any method capable of sendinginstructions from a user's server to clients' browsers.

On the other hand, a practical application of the method requires utmostcare not to give a chance to a so-called cross site scripting attacks.Such an attack refers for example to a situation, in which a given pagehas embedded therein some malicious JavaScript code which issuescommands to a server. Normally, a script is only-able to communicatewith that server which has delivered the page it is embedded in, andtherefore it is impossible for the script to launch an attack againstother servers or to exploit information received from elsewhere.However, if a script resides on a page produced by means of the filterscript ss, it has a right, as far as the browser is concerned, tocommunicate with the filter-script containing server which may havelocated therein information regarding user interfaces prepared foreasier use of the method and possibly passwords. Poorly executed, themethod might facilitate malicious actions, e.g. deletion of files,destruction of prepared presentations, etc.

In this context, however, it is possible with a minor static analysis todisable a certain set of potentially hostile actions performed byscripts. This cannot be done in general extent, but when certainconstructions used by scripts are simply filtered out, it is possible toensure that the remaining code is acceptable. The remaining subset issufficient for generally employed purposes. Commonly employed propertiesinclude e.g.:

-   -   opening of new browsing windows,    -   execution of minor graphic details, e.g. image is changed by        placing a mouse on top of it, and    -   automated checking of form information.

Excluded properties include generally e.g.:

-   -   execution of arbitrary code (eval, etc.). This can also be done        by replacing eval-function calls with eval′-function calls,        wherein the eval′-function applies the presently described        principles to examine a code assigned thereto and thus proceeds        to process a safe code only,    -   sending of arbitrary HTTP-requests to a source server, and    -   functions referring to script variables of a window that has        opened the script-containing window,

It is obvious that the invention is not limited to the applicationsillustrated or described above, but can be varied within the basicinventive concept as required by any given practical applications anddemands. Hence, particularly in view of increasing usability of themethod, e.g. the following expansions are also feasible

-   -   Server has a capability of recording the user's browsing        activities to give him/her a chance, if desirable at some later        occasion, to reproduce them directly for some other client.    -   The script language transaction handler of a JavaScript (or the        like) browser can be used for conveying also other browsing        activities than just following hypertext links to be displayed        by the browser. For example, it is possible at certain intervals        to change the position of a mouse indicator or to display the        input procedures of text imput fields.

1. A method for remote controlling a www-browser, whereby a user isoperating an HTTP-server at his/her disposal by using his/her ownwww-browser for browsing various sources accessible over the Internet,intranet or similar communications network for documents of his/herchoice, such that one or more clients in communication with the serverhave their browsers updated to display each document chosen in variousways by the user with his/her browser to be displayed, wherein wherebyusing solely standardized Internet protocols to control one or moreclients' browsers, said browsers being without additionals, by awww-browser, a user and his/her client or clients, in case the user sopermits, are equally operating with an HTTP-server at his/her/theirdisposal by using his/her/their own www-browser/browsers for browsingvarious sources accessible over Internet, intranet or similarcommunications network for documents of his/her choice, such that theuser and the client/clients in communication with the server havehis/her/their browser/browsers updated actively by themselves to displayeach document chosen by the user with his/her browser, so that, when thedocument chosen to be displayed comprises a hypertext document, such asan html-page or the like, indicated particularly by a URL-address,instead of an actual server response containing the discussedURL-address, the user's browser is supplied with an output (ss(x)) or ahandler, from separate script in communication with the user's server,invoked by referring to the user's server by a specially allocateddomain name, operating as a filter, said output being a responseexternally equivalent to the desired hypertext document identified bythe URL-address or by said address and additional retrieval informationgiven to the filter script as a parameter, such that the following ofhypertext links, or submitting forms or in some other way transiting toanother page results in a request for the filter script by using as itsparameter an address contained in the discussed hypertext link or insome other retrieval information.
 2. The method according to claim 1,wherein after the filter script has been supplied with a desiredURL-address as a parameter, a hypertext document indicated by thediscussed address is first retrieved for processing, whereafter thefilter script is used to replace hypertext links a appearing in thedocument with links which define a request for the filter script withthe discussed hypertext link allocated as an argument therefor, and/orrelative references, such as URL-addresses, present in picture elements,cascading style sheets, and/or the like, are converted into absolutereferences.
 3. The method according to claim 1, wherein when a documentdepends on a given parameter, such as a cookie, user identificationdata, values of hidden fields on a form, and/or the like, the filterscript is used to retrieve the original document from a servercontaining it by giving it the discussed parameter as a parameter for anhttp-request retrieving the discussed document and by storing thisdocument, after screening it for clients to make it externallyequivalent to the original document, in a database or the like, thebrowser of one or more clients being directed to display it therefrom.4. The method according to claim 2, wherein the filter script is used inthe first place to process forms embedded in a desired hypertextdocument, such that the handler defined therein is replaced with ahandler supplied with information of the form, and secondly the originalinformation is embedded as hidden fields in the filtered form.
 5. Themethod according to claim 1, wherein the user interface is used toenable disconnecting the linkage of one or more clients' browser to theuser's browser, especially for making sure that the display of eachclient's www-browser is in all instances only supplied with controlleddocumentation.
 6. The method according to claim 1, wherein the userinterface is used to enable the user to keep open a plurality ofbrowsing windows in the process of browsing documentation and to movefrom window to window in such a way that each client is always providedwith a view of the page which the user has in an active window at thattime.
 7. The method according to claim 1, wherein the scripts present inhypertext documents to be browsed are filtered in such a way that allreferences to various objects containing information of a www-browserare replaced with references to an object, which is created by a scriptembedded in a processed page by the filter script.
 8. A The methodaccording to claim 1, wherein the scripts embedded in www-pages subjectto browsing are allowed to have e.g. the following capabilities of:opening new browsing windows, executing minor graphic details, such asreplacing a picture with other upon placing the mouse on top of it, andautomatically checking information presented in forms.
 9. The methodaccording to claim 7, wherein the scripts emedded in www-pages subjectto browsing are disallowed to have e.g. the following capabilities of:executing an arbitrary code (eval, etc.), sending arbitraryHTTP-requests to a source server, and functions relating to the scriptvariables of a window that has opened the script-containing window. 10.The method according to claim 1, wherein operation of the user interfaceinvolved in utilization of the method enables one or more clients toserve as an active operator supplying documents to other participants.